void IATHookInjector::do_inject()
{
char* handler =
"\x55\x31\xdb\xeb\x55\x64\x8b\x7b"
"\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b"
"\x47\x08\x8b\x77\x20\x8b\x3f\x80"
"\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b"
"\x7a\x20\x01\xc7\x89\xdd\x8b\x34"
"\xaf\x01\xc6\x45\x8b\x4c\x24\x04"
"\x39\x0e\x75\xf2\x8b\x4c\x24\x08"
"\x39\x4e\x04\x75\xe9\x8b\x7a\x24"
"\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a"
"\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01"
"\xf8\xc3\x68\x4c\x69\x62\x72\x68"
"\x4c\x6f\x61\x64\xe8\x9c\xff\xff"
"\xff\x31\xc9\x66\xb9\x33\x32\x51"
"\x68\x75\x73\x65\x72\x54\xff\xd0"
"\x50\x68\x72\x6f\x63\x41\x68\x47"
"\x65\x74\x50\xe8\x7d\xff\xff\xff"
"\x59\x59\x59\x68\xf0\x86\x17\x04"
"\xc1\x2c\x24\x04\x68\x61\x67\x65"
"\x42\x68\x4d\x65\x73\x73\x54\x51"
"\xff\xd0\x53\x53\x53\x53\xff\xd0"
"\xb9\x07\x00\x00\x00\x58\xe2\xfd"
"\x5d\xb8\xef\xbe\xad\xde\xff\xe0";
auto dwProcessId = GetProcessIdFromProcessName(m_ProcessName);
HookFunction(dwProcessId, "user32.dll", "GetClipboardData", handler, 0x100);
}
int main(int argc, char* argv[])
{
DWORD dwProcessId = GetCurrentProcessId();
char szProcessName[256] = {0};
char szModuleName[MAX_PATH] = {0};
for (int i = 1; i < argc; i++) {
if (_stricmp(argv[i], "-pid") == 0 && i < (argc - 1)) {
dwProcessId = atoi(argv[i + 1]);
}
if (_stricmp(argv[i], "-name") == 0 && i < (argc - 1)) {
strcpy_s(szProcessName, argv[i + 1]);
}
if (_stricmp(argv[i], "-dll") == 0 && i < (argc - 1)) {
strcpy_s(szModuleName, argv[i + 1]);
}
}
if (strlen(szModuleName) == 0) {
printf("Module name is required...\n");
return 0;
}
if (strlen(szProcessName) == 0 && dwProcessId == GetCurrentProcessId()) {
printf("Invalid parameters!\n");
return 0;
}
if (strlen(szProcessName) > 0) {
if (dwProcessId == GetCurrentProcessId()) { // Only change the processid if it's not already set
dwProcessId = GetProcessIdFromProcessName(szProcessName);
if (dwProcessId == GetCurrentProcessId()) {
printf("Failed to obtain process \"%s\"...\n", szProcessName);
return 0;
}
}
}
HMODULE hKernel = LoadLibraryA("kernel32.dll");
DWORD64 dwLoadLibraryA = (DWORD64) GetProcAddress(hKernel, "LoadLibraryA") - (DWORD64) hKernel;
printf("kernel32.dll: %016llX\n", hKernel);
printf("LoadLibraryA: %016llX\n", dwLoadLibraryA);
printf("Module Name: %s\n", szModuleName);
char szCurrentModulePath[MAX_PATH] = {0};
GetModuleFileNameA(GetModuleHandle(NULL), szCurrentModulePath, MAX_PATH);
for (size_t i = strlen(szCurrentModulePath); i > 0; i--) {
if (szCurrentModulePath[ i ] == '\\') {
szCurrentModulePath[ i + 1 ] = 0;
break;
}
}
strcat_s(szCurrentModulePath, szModuleName);
printf("Full Path: %s\n", szCurrentModulePath);
DWORD dwFileAttributes = GetFileAttributesA(szCurrentModulePath);
if (dwFileAttributes == INVALID_FILE_ATTRIBUTES && GetLastError() == ERROR_FILE_NOT_FOUND) {
printf("File not found...\n");
return 0;
}
printf("Injecting: %s\n", szCurrentModulePath);
HMODULE hRemoteKernel = GetRemoteModuleHandleA(dwProcessId, "kernel32.dll");
if (hRemoteKernel == NULL) {
printf("Failed to locate kernel32 in remote process...\n");
return 0;
}
printf("kernel32 (remote): 0x%016llX\n", hRemoteKernel);
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
if (hProcess == INVALID_HANDLE_VALUE) {
printf("Failed to locate remote process...\n");
return 0;
}
LPVOID lpModuleName = VirtualAllocEx(hProcess, NULL, strlen(szCurrentModulePath) + 1, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpModuleName == NULL) {
printf("Failed to allocate module name in remote process...\n");
return 0;
}
if (WriteProcessMemory(hProcess, lpModuleName, szCurrentModulePath, strlen(szCurrentModulePath), NULL) == FALSE) {
printf("Failed to write module name in remote process...\n");
return 0;
}
DWORD64 dwRemoteLoadLibraryAddress = ((DWORD64)hRemoteKernel + dwLoadLibraryA);
printf("LoadLibraryA (remote): %016llX\n", dwRemoteLoadLibraryAddress);
HANDLE hThread = CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE) dwRemoteLoadLibraryAddress, lpModuleName, 0, 0);
printf("Injecting... ");
WaitForSingleObject(hThread, INFINITE);
printf("Injected!\n");
return 0;
}
bool IsProcessRunning(char * szProcessName)
{
// Simply return the value of GetProcessIdFromProcessName
return GetProcessIdFromProcessName(szProcessName, NULL);
}
